From fd76b9012635ed3ab114a9780eae82fa97d1941b Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 23 Jan 2026 14:53:18 +1100
Subject: [PATCH] Add enum for use with isc_base64_tobuffer and
 isc_hex_tobuffer

This adds the following enum isc_one_or_more and isc_zero_or_more
which specify if one or more or zeror or more bytes are required
when reading the unbounded base64 / hex encoded data.

(cherry picked from commit 07610f8566daf532f3dbb312526422cd154b5ceb)
---
 lib/isc/base64.c             | 6 +++---
 lib/isc/hex.c                | 6 +++---
 lib/isc/include/isc/base64.h | 7 +++++--
 lib/isc/include/isc/hex.h    | 7 +++++--
 lib/isc/include/isc/types.h  | 6 ++++++
 5 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/lib/isc/base64.c b/lib/isc/base64.c
index ba4ee7148f..3b2d19af70 100644
--- a/lib/isc/base64.c
+++ b/lib/isc/base64.c
@@ -179,7 +179,7 @@ isc_base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length) {
 	isc_token_t token;
 	bool eol;
 
-	REQUIRE(length >= -2);
+	REQUIRE(length >= isc_one_or_more);
 
 	base64_decode_init(&ctx, length, target);
 
@@ -207,7 +207,7 @@ isc_base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length) {
 		isc_lex_ungettoken(lexer, &token);
 	}
 	RETERR(base64_decode_finish(&ctx));
-	if (length == -2 && before == after) {
+	if (length == isc_one_or_more && before == after) {
 		return ISC_R_UNEXPECTEDEND;
 	}
 	return ISC_R_SUCCESS;
@@ -217,7 +217,7 @@ isc_result_t
 isc_base64_decodestring(const char *cstr, isc_buffer_t *target) {
 	base64_decode_ctx_t ctx;
 
-	base64_decode_init(&ctx, -1, target);
+	base64_decode_init(&ctx, isc_zero_or_more, target);
 	for (;;) {
 		int c = *cstr++;
 		if (c == '\0') {
diff --git a/lib/isc/hex.c b/lib/isc/hex.c
index c46ccf8abe..5b7ee6d63a 100644
--- a/lib/isc/hex.c
+++ b/lib/isc/hex.c
@@ -138,7 +138,7 @@ isc_hex_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length) {
 	isc_token_t token;
 	bool eol;
 
-	REQUIRE(length >= -2);
+	REQUIRE(length >= isc_one_or_more);
 
 	hex_decode_init(&ctx, length, target);
 
@@ -166,7 +166,7 @@ isc_hex_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length) {
 		isc_lex_ungettoken(lexer, &token);
 	}
 	RETERR(hex_decode_finish(&ctx));
-	if (length == -2 && before == after) {
+	if (length == isc_one_or_more && before == after) {
 		return ISC_R_UNEXPECTEDEND;
 	}
 	return ISC_R_SUCCESS;
@@ -176,7 +176,7 @@ isc_result_t
 isc_hex_decodestring(const char *cstr, isc_buffer_t *target) {
 	hex_decode_ctx_t ctx;
 
-	hex_decode_init(&ctx, -1, target);
+	hex_decode_init(&ctx, isc_zero_or_more, target);
 	for (;;) {
 		int c = *cstr++;
 		if (c == '\0') {
diff --git a/lib/isc/include/isc/base64.h b/lib/isc/include/isc/base64.h
index b1bc0892df..cf0577472e 100644
--- a/lib/isc/include/isc/base64.h
+++ b/lib/isc/include/isc/base64.h
@@ -75,8 +75,11 @@ isc_base64_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length);
  * `target`. If 'length' is non-negative, it is the expected number of
  * encoded octets to convert.
  *
- * If 'length' is -1 then 0 or more encoded octets are expected.
- * If 'length' is -2 then 1 or more encoded octets are expected.
+ * If 'length' is isc_zero_or_more then 0 or more encoded octets are
+ * expected.
+ *
+ * If 'length' is isc_one_or_more then 1 or more encoded octets are
+ * expected.
  *
  * Returns:
  *\li	#ISC_R_BADBASE64 -- invalid base64 encoding.
diff --git a/lib/isc/include/isc/hex.h b/lib/isc/include/isc/hex.h
index 4599bfc893..d15a56dbdd 100644
--- a/lib/isc/include/isc/hex.h
+++ b/lib/isc/include/isc/hex.h
@@ -88,8 +88,11 @@ isc_hex_tobuffer(isc_lex_t *lexer, isc_buffer_t *target, int length);
  * `target`. If 'length' is non-negative, it is the expected number of
  * encoded octets to convert.
  *
- * If 'length' is -1 then 0 or more encoded octets are expected.
- * If 'length' is -2 then 1 or more encoded octets are expected.
+ * If 'length' is isc_zero_or_more then 0 or more encoded octets are
+ * expected.
+ *
+ * If 'length' is isc_one_or_more then 1 or more encoded octets are
+ * expected.
  *
  * Returns:
  *\li	#ISC_R_BADHEX -- invalid hex encoding
diff --git a/lib/isc/include/isc/types.h b/lib/isc/include/isc/types.h
index 8a74a161aa..3e6baea242 100644
--- a/lib/isc/include/isc/types.h
+++ b/lib/isc/include/isc/types.h
@@ -86,6 +86,12 @@ typedef struct isc_nm_http_endpoints isc_nm_http_endpoints_t;
 /*%< HTTP endpoints set */
 #endif /* HAVE_LIBNGHTTP2 */
 
+/*% Used by isc_base64 and isc_hex for expected lower bound */
+enum {
+	isc_zero_or_more = -1,
+	isc_one_or_more = -2,
+};
+
 /*% Statistics formats (text file or XML) */
 typedef enum {
 	isc_statsformat_file,